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(U) Establishing Reasonable Articulable Suspicion (RAS) 


NEXT FRAME ID: 3020 


(U) This module will enable you to: 

• (TC#S4//NF-)- Recognize the direct relationship between the Foreign Powers and 
establishing RAS 


BACK FRAME ID: n/a 


• (TC#S4//NF) Identify the key components of RAS and how it is applied to candidate 


ALT TAG: 


identifiers 






GRAPHIC/AV: 

(U) Present learning objectives in the travel 
journal 


• (TS^SIZ/NF-) Identify who can adjudicate and approve a RAS nomination 

• fTS#SI#NF-) Recognize the requirement associated with identifiers linked to U.S. 
persons - the OGC First Amendment Review 

• (TSttSWNF) List common sources of information used to construct a RAS 
nomination statement 



TTS//SWNE)- (OGC Attorney): This part of ourtrip will provide you with an overview of the Reasonable Articulable Suspicion (RAS) Standard including 
definitions and descriptions to help you understand how to satisfy RAS and how to apply it to identifiers under the BR and PR/TT FISC Orders. In addition 
to this training, guidance is also outlined in a RAS memo that can be obtained from the Office of General Counsel. 



(TS//ST/NP) This module will enable you to: 

• (TS//S4//NR)- Recognize the direct relationship between the Foreign Powers and establishing RAS 

• < TS//S I // NF> Identify the key components of RAS and how it is applied to candidate identifiers 



TOP S FC RFT//S I// N O F-0RN- 
Page 1 of 17 



Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20 j5050 T 



TOP SECRET// SI//NO F ORN 



• (T6//6 I //N F) Identify who can adjudicate and approve a RAS nomination 

• {X S//S I // NF)- Recognize the requirement associated with identifiers linked to U.S. persons - the OGC First Amendment Review 

• fTS#SF/NF) List common sources of information used to construct a RAS nomination statement 

fFSASI //NF ) At the conclusion of this module you should understand that an identifier must be RAS-approved before conducting a query. The topic of 
querying BR and PR/TT bulk metadata will be discussed in Module 4. 
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.(IS//SI//NF) Who can be targeted under the BR and PR/TT authorities? 
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4TSUSWNF) NSA is not permitted to query the BR and PR/TT metadata unless there is a 



GRAPHIC/AV: 



reasonable articulable suspicion that the identifier is associated with one of the FISC- 



(U) Insert graphics/animations to illustrate 
the umbrella groups and their affiliated 
terrorist organizations 
(U) Add graphics to illustrate contact 
chaining, seeds, and hops. 



approved groups. 



■(TS//S4//NF) (OGC A ttorne y : The B R and PR/ T T Or dersjist b^nameJhe_Forei£r^PowersUial_^ under each authority. T_. 

■Fore ign Powers Orders list in great detail jp 



NSA is not permitted to query the BR and PR/TT metadata unless there 
is a reasonable articulable suspicion that the identifier is associated with one of the FISC-approved groups. 



(TS//S I //NF) It is important to note that you cannot query using just anvforeianinteiliaencetaraet^urtherm^^ 
tarae^fo^C^N however query using identifiers specifically linked 

■■■■las named in the Orders. Note that the lists may evolve and your target may be added or removed over time, so you should reference the 
| most current version of the lists for updates. _ 



TOP SECRE P //SI//N 9P9RN 
Page 3 of 17 



TOP SECRET//SI//NOTORN 



DATE/PREPARER: 11/09/2010 SLS 



Topic 

(U) What is RAS? 



Home 



Page Classification 

-TOP-SECRE T //G 0MtNT//N0F0RN 



Exit f 



Glossary 



Screen Number 
3 of 13 



Back 



Next 



FRAME ID: 3030 



(U) What is Reasonable Articulable Suspicion (RAS)? 



NEXT FRAME ID: 3035 



BACK FRAME ID: 3020 
ALT TAG: 
GRAPHIC/AV: 



(U) Reasonable Articulable Suspicion (RAS) Standard 

(TS//SI//NF )- An identifier will meet the Reasonable Articulable Suspicion Standard if based on 
the factual and practical considerations of everyday life on which reasonable and prudent 
persons act, there are facts giving rise to a reasonable articulable suspicion that the identifier is 
associated with one of the specified Foreign Powers. 

- Foreign Intelligence Surveillance Court 



(U) Display pop-up with the definition of 
RAS as it is discussed. 



(TS/'/'SI/'/NF) (OGC Attorney): The FISC recognizes the potential counterterrorism advantage gained through analysis of the BR and PR/TT bulk metadata; 
however, because there is a great deal of U.S. person information included in the bulk metadata, the FISC has set strict guidelines on when and how 
analysts can access the metadata under these authorities. The RAS standard is one of these guidelines which helps to provide reasonable assurance that 
only legitimate terrorism-related identifiers are used to query the bulk metadata. This standard must be met before queries can be conducted. 

-( TS//S I // NF) So what is RAS? RAS is a legal standard that describes the measure of proof required to support a decision whether to permit an identifier to 
be queried from the bulk metadata. The Reasonable Articulable Suspicion standard requires just that-a suspicion that you can explain in a reasonable way. 
It does not require certainty, but is more concrete than a simple hunch. It may be easiest to think of it in terms of other standards with which you may be 
familiar. 



(TS//SI//NF) Many of you may be familiar with legal standards of proof applicable in other situations. It may be helpful to understand how the RAS standard 
compares to these other legal standards. For example, a jury in a criminal case will not convict an accused unless the evidence of guilt is "beyond a 
reasonable doubt. “This is the highest legal standard of proof. A jury in a civil case (such as a personal injury case or a contract dispute) might award a 
plaintiff money damages if the plaintiff proves the elements of his claim by ”a preponderance of the evidence.” This standard is lower than "beyond a 
reasonable doubt.“ Lower still is the standard of proof required to justify issuance of a search warrant - "probable cause” - whether that search warrant is 
for the suspect’s home or the content of the suspect’s communications. The RAS standard falls below "probable cause." 
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(TS//S I //N F) The FISC has determined that this lower standard of proof is reasonable for the querying of metadata because communications metadata 
does not carry with it the same privacy protections as communications content. The RAS standard falls below "probable cause” but above a mere hunch or 
guess. 
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(U) The RAS Equation 

(U) (Continue to display definition of RAS then pull out the RAS Equation.) 
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Reasonable Articulable Suspicion (RAS) Standard 

•fFSAS-F /NF) An identifier will meet the Reasonable Articulable Suspicion Standard if based on 
the factual and practical considerations of everyday life on which reasonable and prudent 
persons act, there are facts giving rise to a reasonable articulable suspicion that the identifier is 
associated with one of the specified Foreign Powers.” 

- Foreign Intelligence Surveillance Court 



GRAPHIC/AV: 

(U) Continue to display definition of RAS 
then pull out the RAS Equation. 



RAS Equation 

Identifier + Link to Foreign Power = RAS 



(TS//S+//NF)- (OGC Attorney): As it applies to the B R and PR/TT Orders, RAS is a suspicion that an identifiersoch as an amdi^ddfess^eleohonomumber, 
or other identifier type, is associated with one of the^|Foreign Powers named in BR and PR/TT Orders 

FISC requires that NSA base that suspicion on a certain level of factual evidence -- and NSA must articulate those facts that connect the identifier with one 
of the named terrorist organizations. The requirement that these facts be articulable effectively provides reasonable assurance that analyst queries of the 
metadata are based on substantive information (meaning more than simple hunches or uninformed guesswork). So in order to obtain RAS approval for an 
identifier, analysts must provide enough factual evidence that it would lead a reasonable person to suspect that an identifier is associated with one of the 
named Foreign Powers in the BR and PR/TT Orders. We will get more into the kinds of facts that may be used and how they can support a RAS 
nomination later in this module. 

■(TS#S+//I\F) In summary, based on the factual and practical considerations of everyday life ( 
determineifther^ suspicion that the identifier is associated with || 



Inamed in the Orders. There must be at least one qualifying fact giving rise to the suspicion that the identifier is associated 

with one of the Foreign Powers listed in the BR and PR/TT Orders. Unless that determination is made, the identifier cannot be approved to query this 
metadata repository. NSA’s implementation of the BR and PR/T^Orders mandates that the RAS nomination statement must clearly link the identifier/target 
to one of the Foreign Powers and document this finding in^^^^^B which will be discussed later in the module. 
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GRAPHIC/AV: 

(U) Analyst Level of Effort Required graphic 



TT^umr) (HMC Character): From an Analysis and Production standpoint, let’s look at RAS in the context of the analyst level of effort required to utilize 
BR and PR/TT and other SIGINT authorities. As the illustration shows, the level of effort required by an analyst to establish RAS would normally be 
considered less than that required for FBI CT FISA or FAA 704/705b, but it is more than what is needed to utilize E.O. 12333, for example. 
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(U) Who can make a RAS determination? 
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(U) Who can make a RAS determination? 

• (U// TOUO) Homeland Mission Coordinators (HMCs) 

• (U/ /FOUO) Chief of the CT Homeland Security Analysis Center 

• (U //TOUQ) Deputy Chief of the CT Homeland Security Analysis 
Center 

(U) No one else can make tins determination! 



fT3//0l//NF) (OGC Attorney): The FISC states that the RAS decision is based on considerations of “reasonable and prudent persons.” This does not, 
however, mean that anyone can approve an identifier for RAS. There are a select number of people within NSA who have been given the authority to 
approve identifiers for querying under these two authorities. Those individuals are called Homeland Mission Coordinators or HMCs. 

( T S//S I //NF) (HMC Character): As was just mentioned, RAS determinations are typically made by specially trained personnel in the Office of 
Counterterrorism and its Extended Enterprise; these individuals are titled Homeland Mission Coordinators, typically abbreviated as HMCs. These 
individuals, like me, have been given special training on how to apply the RAS standard and how to apply it consistently. HMCs are specially trained 
individuals who have extensive experience working with this target set and who have extensive experience working with these authorities. The HMCs can 
take a RAS nomination, review the facts, and make a determination as to whether or not that particular identifier meets the RAS standard. 

(TS//S I //N F)- (HMC Character): According to the BR and PR/TT Orders, in addition to the HMCs, the Chief and Deputy Chief of the Counterterrorism 
Homeland Security Analysis Center are authorized to make a RAS determination; although, it is generally the HMCs who make the RAS determinations. To 
reemphasize, no one else is authorized to make RAS determinations according to the Orders. 
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(U) First Amendment Rights 

• Religion 

• Speech 

• The press 

• Peaceable assembly 

• To petition the government for redress of grievances 
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t TS//Q I //l l ' JF ) (HMC Character): There are certain identifiers that require an extra RAS review/approval step. As you might imagine, those are the identifiers 
that are reasonably believed to be used by U.S. persons. Why does this matter? It matters because the U.S. Government is forbidden from regarding a 
U.S. person as associated with a Foreign Power solely because he or she is exercising his or her First Amendment rights. 



(TS//SI//NF) ( OGC Attorney): That’s right. Any identifier believed to be used by a U.S. person must be forwarded to the OGC by a Homeland Mission 
Coordinator following his or her approval. An OGC attorney will review the RAS nomination, as well as the RAS decision made by the Homeland Mission 
Coordinator, and make a determination as to whether or not NSA is targeting that individual based solely on activities that are protected by the First 
Amendment to the Constitution. If there is any indication that the RAS is based solely on information or evidence protected somehow by the First 
Amendment, OGC will require additional infonnation to support the RAS nomination. 



- (TS//S I //N F) (HMC Character): If you are an analyst, should you abandon a RAS nomination if there is a potential First Amendment concern? Absolutely 
not. The presence of First Amendment evidence does not invalidate a RAS, it just cannot be the sole basis for a nomination. The OGC review is really 
transparent to the analyst, though it is a part of the process that you should be aware of. 
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(U) What sources of information can be used to justify RAS? 
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fF&VSItWF) FISA Orders 

• Existing FISA Orders 

Reports and/or RAW 
SIGINT 

• SIGINT reports 

• FISA surveillance data derived from other 
authorized targets 

• Raw SIGINT (after a Reporting Source 
Validation Check) 

• SIGDEV Work 

' Other transcripts 



fFS#SI//NF) IC and Public Sector 

• Federal Bureau of Investigation documents 

4 Central Intelligence Agency documents 

4 National Counterterrorism Center 

documents 

4 Documents from other U.S. Government 

Organizations 

4 Foreign Partner nations 

4 Public records available on the 

internet, newspapers, or other public 
resources 



UST7St/7NF) (HMC Character): So now let’s look at the type of evidence that can be used to justify RAS. NSA can use any information that is lawfully in our 
possession. A published SIGINT report describing the results of electronic surveillance of a target might be more reliable than say pocket litter found during 
a detainee’s interrogation -- but NSA can rely on any lawfully held evidence. The HMCs are responsible for assessing the quality and reliability of the 
evidence. 



■(TS//S1//NF) (OGC Attorney): Sources that are often used to justify a RAS nomination include, but are not limited to: 

• Existing FISA Orders 

• SIGINT reports 

• FISA surveillance data derived from other authorized targets 

• SIGINT traffic, as long as the submitting analyst has performed a Reporting Source Validation Check 

• SIGDEV work (with verified sources), and 

• Other transcripts 




If an analyst/requestor uses unpublished query results in a RAS justifi cation, and the y classify the material appropriately as 
then that information will only be visible to those ^^^^^lusers with I 



I credentials, as confirmed 
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-( TS/;S I /; [\F)- (OGC Attorney): The following 1C and public sector (open source) sources are also examples of sources that are frequently used: 

• Federal Bureau of Investigation (FBI) documents 

• Central Intelligence Agency (CIA) documents 

• The National Counterterrorism Center (NCTC) documents 

• Documents from other U.S. Government Organizations 

• Foreign Partner nations, and 

• Public records available on the internet, newspapers, or other public resources. 
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NSA’s RAS Identifier Management System 
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• <TS//SP/NF)-Supports the Homeland Defense Counterterrorism (CT) Mission. 

• ■(TS//Sl7 i /NF) Provides the ability to request, justify, review, approve/disapprove RAS 
nominations/requests. 

• {TS//SP/NF} Is the authoritative source for the list of RAS-approved identifiers and will export that list to 
other systems that require it. 

• -(TS/ZCWNF) Provides metrics and other information to facilitate oversight review and report generation for 
the Department of Justice (DOJ) and the FISC. 

(U) Time Bounded Approvals 



fFS//SP/NF) (HMC Character): Remember from earlier in this module, we introduced the RAS process as a simple equation: identifier + link to Foreign 
Powers = RAS. Now you may be wondering how an identifier is nominated for RAS. NSA must demonstrate and document that ev^^^^^^r used to 
query the bulk metadata meets the RAS standard PRIOR to querying the BR and PR/TT bulk metadata repositories. NSA created^^^^^B the RAS 
identifier management tool, to streamline the adjudication of the RAS nomination statements and documentation of RAS determinations. 



{TS//SWNF) (HMC Character): Typically, an intelliaenc^nalvst will gather the necessary information and draft the nomination statement in IRONMAN 
articulating the RAS equation. An HMC, also usmcj^^^^^B will review the nomination statement and approve or disapprove the request. If the 
nomination statement is for a U.S. person, the^^^^^B°°l ' ncludes functionality that allows the HMCs to forward such requests to OGC for the required 
First Amendment review. In either case, if the RAS nomination is approved, the identifier is now authorized for querying. 

-(T 3//G I//NF) (OGC Attorney): Through ^^^J^B^SA documents all RAS-approved identifierii^^^^^^the rationale used to gain RAS approval. 
IRONMAN provides the ability to view, approve/disapprove RAS nominations. is therefore the authoritative source for the list 

of RAS-approved identifiers, and ^^^^^ffexports that list to other systems that require it. 

( TS // S I//NF) (OGC Attorney): It is important to remember that copies of the documents, such as court orders or reports, are required as part of the 
nomination process. The paper trail should enable an auditor from Department of Justice (DOJ) to clearly evaluate all of the evidence presented to support 
a RAS decision. 
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TTSASP/NF) (OGC Attorney): NSA has overseers, specifically the DOJ National Security Division attorneys, who examine the factual support for our RAS 
decision process. They take a look at any notes that the HMCs or someone within the NSA OGC may have included, and they decide whether or not we 
have properly applied the RAS standard to all of the identifiers that are used to query the bulk metadata. So it is critical that we take great ce 
the process, gathering and presenting the evidence and applying the RAS standard in a consistent manner across all identifier nominations, 
also provides metrics and other information to facilitate this oversight review and report generation for the DOJ and the FISC. 

(TSASP/NF) (OGC Attorney) The Court recognizes that occasionally, NSA may have information suggesting that a target may have used a particular 
identifier only for a limited time. In such cases, an HMC can determine that the RAS standard is met for the sp ecific tirr^Jra me that the identifier was 
believed to be used by the target. Such instances are considered Time Bounded and are uniquely dealt with in Analysts encountering targets 

under these circumstances should consult with an HMC on how to proceed. 
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RAS determinations for foreign identifiers are legally effective for one 
year. NSA CT has implemented guidance that requires RAS review/re-approval every 
180 days. 
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(U) Use a graphic to show effective dates 
for U.S. and non-U. S. person RAS 
approval 



■fPS#S4ANR> Although a RAS determination for an identifier reasonably believed to be 
used by a United States person is legally effective for 180 days, NSA CT has 
implemented guidance that requires RAS review/re-approval every 90 days. 

ffS#S4//NR) After the sunset of an identifier’s RAS approval -- or anytime before -- the 
identifier can be submitted for RAS revalidation through the same process. 



(U) (Show passing of time and then a 
graphic of an identifier with a “RAS- 
APPROVED” or “DENIED” applied over the 
identifier) 



(TG//SP/NF) (HMC Character): RAS approvals have sunset or expiration dates which analysts must comply with. Currently a RAS approval on a foreign 
identifier, per the FISC, is legally valid for one year. However, NSA CT has taken a conservative approach and implemented guidance that mandates RAS 
review and re-approval every 180 days. Likewise, a RAS approval for an identifier believed to be used by a U.S. person has a legal lifespan of 180 days 
per the FISC, but NSA CT has implemented guidance requiring review and re-approval every 90 days. It is the analyst’s responsibility to monitor the sunset 
dates and take appropriate actions before the RAS nomination expires. 



(TG//SP/NF) (HMC Character): Any identifier can be resubmitted for revalidation at any time. Revalidations require proof of the same categories of 
information that was required for the original request. Revalidations should try to validate that the original evidence is still true by presenting any new 
documentation to demonstrate that the identifier is still associated with the Foreign Powers named in the Orders. It is up to the HMCs to make an informed 
revalidation, based on the totality of the evidence. If you are uncertain of your evidence, submit the nomination anyway and work with the HMCs through 
the process. 
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(U) Knowledge Check 

1 . (TS//S+//NF) Why is the link between the target and the Foreign Powers an essential part of the RAS 
nomination? 

a) -(TSf/SP/NF) It is a key component in reaching the ‘probable cause’ standard 

b) (TS//Si//NF) It is representative of the terrorist centric scope of the BR and PR/TT authorities 
as noted in the FISC Orders 

c) (U) Because it is required by USSID SP0018 and DoD 5240.1 -R 

d) (U) Because it is required in a DIRNSA Memo 

2. <TS#SP/NF) The RAS standard requires that what two facts are articulable? 

a) fTSf/SttfNF) The identifier can be tied to a terrorist target and that target can be tied to| 

b) (TS//SI//NF) The identifier is not used by a U.S. person and they are engaged in terrorist 
activities 

c) f T S //S I // NREieidentifiercan^ and that target is affiliated with|| 



d) *( i S//SI//NF) i ne query can be traced back to the analyst who submitted it and the identifier is 
associated with any terrorist group. 



(U) (HMC Character): Let’s check what you remember from this topic! 



ANSWERS: 

Question 1 : tTS/fSP/NF) Correct! The link between the target and the Foreign Powers is an essential part of the RAS nomination because it is 
representative of the terrorist centric scope of the BR and PR/TT authorities as noted in the FISC Orders. 

(TS//SI//NF) Incorrect. The correct answer is b). The link between the target and the Foreign Powers is an essential part of the RAS nomination because it 
is representative of the terrorist centric scope of the BR and PR/TT authorities as noted in the FISC Orders. 

Question 2: (TS#SP/NF) Correct! The RAS standard requires that the following two facts are articulable: 

• The identifier can be tied toaterroristtaraeLand^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 

can be to 

(T S//S I //N F) Incorrect. The correct answer is a). The RAS standard requires that the following two facts are articulable: 

• The identifier can be tied to a terrorist target, and 

• That target can be tied to 
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3. '(TS//Sl77NP)‘Who may make a RAS determination? 

a) (TS#S+#NF)-A Homeland Mission Coordinator (HMC) or an attorney with the Department of 
Justice 
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b) (T S//S I //N F-) An HMC or other official named in the Orders 

c) -(TS //S t // f4F) Any reasonable and prudent analyst (and OGC if identifier is believed to be used by 
a U.S. person) 

d) -( T S//SI//NF) Only a judge from the FISC 

4. (TS//S+//NF) Which source of information may be used to justify RAS? 

a) ( T5//S I //NF) SIGINT reports 

b) ( TS//S I // NF)Open source information 

c) (TS#St//NF) Second Party reports 

d) fF S / ZS I Z/ NF) All of the above 



5. (TSASP/NF) What additional requirement is needed for an identifier reasonably believed to be used by a 
U.S. person? 

a) (TS#SP/NF) Must be reviewed by the Attorney General 

b) (TS//SI//NF) Must be reviewed by the Chief of the Homeland Security Analysis Center 

c) (TS//SI//NF)-Must be reviewed by OGC 

d) (TS//SI//NF) Two HMCs must agree on the RAS determination 



(No audio or transcript on this page) 



Question 3: (TS//SI//NF) Correct! An HMC or other official named in the Orders may make a RAS determination. 

(TS//S+//WF) Incorrect. The correct answer is b). An HMC or other official named in the Orders may make a RAS determination. 

Question 4: (TSASP/NF) Correct! SIGINT reports, open source information, and Second Party reports may all be used to justify RAS. 

(TS//SI//NF) Incorrect. The correct answer is d). SIGINT reports, open source information, and Second Party reports may all be used to justify RAS. 

Question 5: (TS//SF/NF) Correct! If an identifier is reasonably believed to be used by a U.S. person, then it must be reviewed by OGC. 

( T S // SI // NF) Incorrect. The correct answer is c). If an identifier is reasonably believed to be used by a U.S. person, then it must be reviewed by OGC. 
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(U) Now that we have completed this part of your trip you should be able to: 

. (^S#Sf //NF) -Recognize the direct relationship between the Foreign Powers and 
establishing RAS 

. {XSUSiUNE -)- Identify the key components of RAS and how it is applied to candidate 
identifiers 
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(TS^S-b ¥NF') Identify who can adjudicate and approve a RAS nomination 

(IS//S4//NF-) Recognize the requirement associated with identifiers linked to U.S. 
persons - the OGC First Amendment Review 

(TS#S4//NF-) List common sources of information used to construct a RAS 
nomination statement 



(U) Review learning objectives in the travel 
journal 



(TS/ZSt/rNF) (HMC Character): So remember, RAS nominations are approved by an HMC (or an official named in the Order) BEFORE queries can be 
made using a particular identifier within the BR or PR/TT metadata. 



(U) (OGC Attorney): Now that we have completed this part of the trip you should be able to: 

• (TS//SI//NF) Recognize the direct relationship between the Foreign Powers and establishing RAS 

• (T S//S I // NF) Identify the key components of RAS and how it is applied to candidate identifiers 

• (TS//SI//NF) Identify who can adjudicate and approve a RAS nomination 

• (TS//S I //NF) Recognize the requirement associated with identifiers linked to U.S. persons - the OGC First Amendment Review 

• (TS//S1//NF) List common sources of information used to construct a RAS nomination statement 



TOP SECRET//SI//NOF QR N 
Page 17 of 17 



